@hoangsonw/forge 0.1.0

package/dist/daemon/updater.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updater.d.ts","sourceRoot":"","sources":["../../src/daemon/updater.ts"],"names":[],"mappings":"AAWA,UAAU,UAAU;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAyBD,eAAO,MAAM,SAAS,QAAO,UAAU,GAAG,IAMzC,CAAC;AA+BF,eAAO,MAAM,cAAc,GACzB,OAAM;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,KAC7B,OAAO,CAAC,UAAU,GAAG,IAAI,CA+B3B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,KAAG,IAQ/C,CAAC;AAEF,eAAO,MAAM,cAAc,QAAO,MAA0B,CAAC;AAE7D,eAAO,MAAM,WAAW,GACtB,UAAS,QAAQ,GAAG,MAAM,GAAG,SAAoB,KAChD,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAO7D,CAAC"}

package/dist/daemon/updater.js

@@ -0,0 +1,159 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyUpdate = exports.currentVersion = exports.ignoreVersion = exports.checkForUpdate = exports.readCache = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const semver = __importStar(require("semver"));
+const undici_1 = require("undici");
+const paths_1 = require("../config/paths");
+const loader_1 = require("../config/loader");
+const logger_1 = require("../logging/logger");
+const download_1 = require("../release/download");
+const CACHE_FILE = path.join(paths_1.paths.logs, 'update-check.json');
+const readPkgVersion = () => {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'package.json'), 'utf8'));
+        return String(pkg.version ?? '0.0.0');
+    }
+    catch {
+        return '0.0.0';
+    }
+};
+const shouldCheckNow = () => {
+    try {
+        if (!fs.existsSync(CACHE_FILE))
+            return true;
+        const raw = JSON.parse(fs.readFileSync(CACHE_FILE, 'utf8'));
+        const last = new Date(raw.lastChecked).getTime();
+        const intervalMs = (0, loader_1.loadGlobalConfig)().update.checkIntervalHours * 3600_000;
+        return Date.now() - last > intervalMs;
+    }
+    catch {
+        return true;
+    }
+};
+const readCache = () => {
+    try {
+        return JSON.parse(fs.readFileSync(CACHE_FILE, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+};
+exports.readCache = readCache;
+const writeCache = (data) => {
+    (0, paths_1.ensureForgeHome)();
+    fs.writeFileSync(CACHE_FILE, JSON.stringify(data, null, 2));
+};
+const fetchLatest = async (channel) => {
+    // Default to the npm registry; teams can host their own. We treat the
+    // network fetch as best-effort and never block.
+    try {
+        const res = await (0, undici_1.request)('https://registry.npmjs.org/@forge/cli', {
+            method: 'GET',
+            headersTimeout: 8000,
+            bodyTimeout: 8000,
+        });
+        if (res.statusCode !== 200)
+            return null;
+        const body = (await res.body.json());
+        const tags = body['dist-tags'] ?? {};
+        if (channel === 'beta' && tags.beta)
+            return tags.beta;
+        if (channel === 'nightly' && tags.nightly)
+            return tags.nightly;
+        return tags.latest ?? null;
+    }
+    catch (err) {
+        logger_1.log.debug('update check network error', { err: String(err) });
+        return null;
+    }
+};
+const checkForUpdate = async (opts = {}) => {
+    const cfg = (0, loader_1.loadGlobalConfig)();
+    if (!cfg.update.autoCheck && !opts.force)
+        return null;
+    if (!opts.force && !shouldCheckNow())
+        return (0, exports.readCache)();
+    const current = readPkgVersion();
+    const latest = await fetchLatest(cfg.update.channel);
+    if (!latest) {
+        const cache = {
+            lastChecked: new Date().toISOString(),
+            latestVersion: current,
+            currentVersion: current,
+            hasUpdate: false,
+            channel: cfg.update.channel,
+        };
+        writeCache(cache);
+        return cache;
+    }
+    const hasUpdate = semver.valid(latest) && semver.valid(current)
+        ? semver.gt(latest, current) && !cfg.update.ignoredVersions.includes(latest)
+        : false;
+    const cache = {
+        lastChecked: new Date().toISOString(),
+        latestVersion: latest,
+        currentVersion: current,
+        hasUpdate: Boolean(hasUpdate),
+        channel: cfg.update.channel,
+    };
+    writeCache(cache);
+    return cache;
+};
+exports.checkForUpdate = checkForUpdate;
+const ignoreVersion = (version) => {
+    (0, loader_1.updateGlobalConfig)((cfg) => ({
+        ...cfg,
+        update: {
+            ...cfg.update,
+            ignoredVersions: [...new Set([...cfg.update.ignoredVersions, version])],
+        },
+    }));
+};
+exports.ignoreVersion = ignoreVersion;
+const currentVersion = () => readPkgVersion();
+exports.currentVersion = currentVersion;
+const applyUpdate = async (channel = 'stable') => {
+    const release = await (0, download_1.resolveLatest)(channel);
+    if (!release) {
+        return { applied: false, detail: 'no release found' };
+    }
+    const result = await (0, download_1.downloadAndVerify)(release, paths_1.paths.bin);
+    return { applied: true, path: result.artifactPath, detail: `${release.tag}: ${result.detail}` };
+};
+exports.applyUpdate = applyUpdate;
+//# sourceMappingURL=updater.js.map

package/dist/daemon/updater.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"updater.js","sourceRoot":"","sources":["../../src/daemon/updater.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAiC;AACjC,mCAAiC;AACjC,2CAAyD;AACzD,6CAAwE;AACxE,8CAAwC;AACxC,kDAAuE;AAEvE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,aAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;AAW9D,MAAM,cAAc,GAAG,GAAW,EAAE;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC1E,CAAC;QACF,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,GAAY,EAAE;IACnC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAe,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,IAAA,yBAAgB,GAAE,CAAC,MAAM,CAAC,kBAAkB,GAAG,QAAQ,CAAC;QAC3E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEK,MAAM,SAAS,GAAG,GAAsB,EAAE;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAe,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AANW,QAAA,SAAS,aAMpB;AAEF,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAQ,EAAE;IAC5C,IAAA,uBAAe,GAAE,CAAC;IAClB,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,KAAK,EAAE,OAAe,EAA0B,EAAE;IACpE,sEAAsE;IACtE,gDAAgD;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAO,EAAC,uCAAuC,EAAE;YACjE,MAAM,EAAE,KAAK;YACb,cAAc,EAAE,IAAI;YACpB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAGlC,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QACtD,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QAC/D,OAAO,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEK,MAAM,cAAc,GAAG,KAAK,EACjC,OAA4B,EAAE,EACF,EAAE;IAC9B,MAAM,GAAG,GAAG,IAAA,yBAAgB,GAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO,IAAA,iBAAS,GAAE,CAAC;IAEzD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,KAAK,GAAe;YACxB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,aAAa,EAAE,OAAO;YACtB,cAAc,EAAE,OAAO;YACvB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;SAC5B,CAAC;QACF,UAAU,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GACb,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5E,CAAC,CAAC,KAAK,CAAC;IACZ,MAAM,KAAK,GAAe;QACxB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,aAAa,EAAE,MAAM;QACrB,cAAc,EAAE,OAAO;QACvB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC;QAC7B,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;KAC5B,CAAC;IACF,UAAU,CAAC,KAAK,CAAC,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAjCW,QAAA,cAAc,kBAiCzB;AAEK,MAAM,aAAa,GAAG,CAAC,OAAe,EAAQ,EAAE;IACrD,IAAA,2BAAkB,EAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,GAAG,GAAG;QACN,MAAM,EAAE;YACN,GAAG,GAAG,CAAC,MAAM;YACb,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;SACxE;KACF,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AARW,QAAA,aAAa,iBAQxB;AAEK,MAAM,cAAc,GAAG,GAAW,EAAE,CAAC,cAAc,EAAE,CAAC;AAAhD,QAAA,cAAc,kBAAkC;AAEtD,MAAM,WAAW,GAAG,KAAK,EAC9B,UAAyC,QAAQ,EACa,EAAE;IAChE,MAAM,OAAO,GAAG,MAAM,IAAA,wBAAa,EAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAiB,EAAC,OAAO,EAAE,aAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;AAClG,CAAC,CAAC;AATW,QAAA,WAAW,eAStB"}

package/dist/keychain/index.d.ts

@@ -0,0 +1,8 @@
+export declare const setSecret: (service: string, account: string, value: string) => void;
+export declare const getSecret: (service: string, account: string) => string | null;
+export declare const deleteSecret: (service: string, account: string) => boolean;
+export declare const keychainStatus: () => {
+    backend: string;
+    home: string;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/keychain/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keychain/index.ts"],"names":[],"mappings":"AA2KA,eAAO,MAAM,SAAS,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,EAAE,OAAO,MAAM,KAAG,IAY3E,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,KAAG,MAAM,GAAG,IAarE,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,KAAG,OAQ/D,CAAC;AAEF,eAAO,MAAM,cAAc,QAAO;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAG/D,CAAC"}

package/dist/keychain/index.js

@@ -0,0 +1,243 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keychainStatus = exports.deleteSecret = exports.getSecret = exports.setSecret = void 0;
+/**
+ * Secret storage with best-effort OS keychain integration and an encrypted
+ * file-based fallback. The keychain integrations shell out to well-known
+ * utilities (security on macOS, secret-tool on Linux) so we don't carry
+ * native-module risk in the hot path.
+ *
+ * Storage model:
+ *   - Key is `service::account`
+ *   - Value is a UTF-8 string (we encrypt it before writing regardless)
+ *   - Fallback: AES-256-GCM at `~/.forge/mcp/tokens/<service-account>.enc`
+ *     keyed off a machine-local key saved with user-only permissions.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const crypto = __importStar(require("crypto"));
+const child_process_1 = require("child_process");
+const paths_1 = require("../config/paths");
+const logger_1 = require("../logging/logger");
+const windows_1 = require("./windows");
+const SERVICE_PREFIX = 'com.forge.cli';
+const KEY_FILE = path.join(paths_1.paths.home, '.keyfile');
+const ensureKey = () => {
+    (0, paths_1.ensureForgeHome)();
+    if (fs.existsSync(KEY_FILE)) {
+        return fs.readFileSync(KEY_FILE);
+    }
+    const key = crypto.randomBytes(32);
+    fs.writeFileSync(KEY_FILE, key, { mode: 0o600 });
+    return key;
+};
+const encrypt = (plaintext) => {
+    const key = ensureKey();
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const enc = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, enc]);
+};
+const decrypt = (blob) => {
+    const key = ensureKey();
+    const iv = blob.subarray(0, 12);
+    const tag = blob.subarray(12, 28);
+    const enc = blob.subarray(28);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    const dec = Buffer.concat([decipher.update(enc), decipher.final()]);
+    return dec.toString('utf8');
+};
+const tokenFile = (service, account) => {
+    const safe = `${service}-${account}`.replace(/[^A-Za-z0-9._-]/g, '_');
+    return path.join(paths_1.paths.mcpTokens, `${safe}.enc`);
+};
+const saveFallback = (service, account, value) => {
+    fs.mkdirSync(paths_1.paths.mcpTokens, { recursive: true });
+    fs.writeFileSync(tokenFile(service, account), encrypt(value), { mode: 0o600 });
+};
+const loadFallback = (service, account) => {
+    const fp = tokenFile(service, account);
+    if (!fs.existsSync(fp))
+        return null;
+    try {
+        return decrypt(fs.readFileSync(fp));
+    }
+    catch (err) {
+        logger_1.log.warn('keychain: failed to decrypt fallback token', { err: String(err) });
+        return null;
+    }
+};
+const deleteFallback = (service, account) => {
+    const fp = tokenFile(service, account);
+    if (!fs.existsSync(fp))
+        return false;
+    fs.unlinkSync(fp);
+    return true;
+};
+// ---- macOS ----
+const macSet = (service, account, value) => {
+    const r = (0, child_process_1.spawnSync)('security', [
+        'add-generic-password',
+        '-U',
+        '-s',
+        `${SERVICE_PREFIX}.${service}`,
+        '-a',
+        account,
+        '-w',
+        value,
+    ], { encoding: 'utf8' });
+    return r.status === 0;
+};
+const macGet = (service, account) => {
+    const r = (0, child_process_1.spawnSync)('security', ['find-generic-password', '-s', `${SERVICE_PREFIX}.${service}`, '-a', account, '-w'], { encoding: 'utf8' });
+    if (r.status !== 0)
+        return null;
+    return r.stdout.trim() || null;
+};
+const macDel = (service, account) => {
+    const r = (0, child_process_1.spawnSync)('security', [
+        'delete-generic-password',
+        '-s',
+        `${SERVICE_PREFIX}.${service}`,
+        '-a',
+        account,
+    ]);
+    return r.status === 0;
+};
+// ---- Linux (secret-tool) ----
+const linuxSet = (service, account, value) => {
+    const r = (0, child_process_1.spawnSync)('secret-tool', [
+        'store',
+        '--label',
+        `Forge: ${service}`,
+        'service',
+        `${SERVICE_PREFIX}.${service}`,
+        'account',
+        account,
+    ], { input: value, encoding: 'utf8' });
+    return r.status === 0;
+};
+const linuxGet = (service, account) => {
+    const r = (0, child_process_1.spawnSync)('secret-tool', ['lookup', 'service', `${SERVICE_PREFIX}.${service}`, 'account', account], { encoding: 'utf8' });
+    if (r.status !== 0)
+        return null;
+    return r.stdout.trim() || null;
+};
+const linuxDel = (service, account) => {
+    const r = (0, child_process_1.spawnSync)('secret-tool', [
+        'clear',
+        'service',
+        `${SERVICE_PREFIX}.${service}`,
+        'account',
+        account,
+    ]);
+    return r.status === 0;
+};
+const hasCommand = (cmd) => {
+    const r = (0, child_process_1.spawnSync)(process.platform === 'win32' ? 'where' : 'command', ['-v', cmd], {
+        encoding: 'utf8',
+    });
+    return r.status === 0;
+};
+const useNative = () => {
+    if (process.platform === 'darwin' && hasCommand('security'))
+        return 'mac';
+    if (process.platform === 'linux' && hasCommand('secret-tool'))
+        return 'linux';
+    if (process.platform === 'win32' && (0, windows_1.isWindowsKeychainAvailable)())
+        return 'windows';
+    return 'none';
+};
+const setSecret = (service, account, value) => {
+    const mode = useNative();
+    let ok = false;
+    if (mode === 'mac')
+        ok = macSet(service, account, value);
+    else if (mode === 'linux')
+        ok = linuxSet(service, account, value);
+    else if (mode === 'windows')
+        ok = (0, windows_1.winSet)(service, account, value);
+    if (!ok) {
+        logger_1.log.debug('keychain: using encrypted fallback', { service, account, mode });
+        saveFallback(service, account, value);
+    }
+    else {
+        deleteFallback(service, account);
+    }
+};
+exports.setSecret = setSecret;
+const getSecret = (service, account) => {
+    const mode = useNative();
+    if (mode === 'mac') {
+        const v = macGet(service, account);
+        if (v)
+            return v;
+    }
+    else if (mode === 'linux') {
+        const v = linuxGet(service, account);
+        if (v)
+            return v;
+    }
+    else if (mode === 'windows') {
+        const v = (0, windows_1.winGet)(service, account);
+        if (v)
+            return v;
+    }
+    return loadFallback(service, account);
+};
+exports.getSecret = getSecret;
+const deleteSecret = (service, account) => {
+    const mode = useNative();
+    let ok = false;
+    if (mode === 'mac')
+        ok = macDel(service, account);
+    else if (mode === 'linux')
+        ok = linuxDel(service, account);
+    else if (mode === 'windows')
+        ok = (0, windows_1.winDelete)(service, account);
+    const fallbackOk = deleteFallback(service, account);
+    return ok || fallbackOk;
+};
+exports.deleteSecret = deleteSecret;
+const keychainStatus = () => ({
+    backend: useNative(),
+    home: os.homedir(),
+});
+exports.keychainStatus = keychainStatus;
+//# sourceMappingURL=index.js.map

package/dist/keychain/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keychain/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;GAWG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,+CAAiC;AACjC,iDAA0C;AAC1C,2CAAyD;AACzD,8CAAwC;AACxC,uCAAkF;AAElF,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAEnD,MAAM,SAAS,GAAG,GAAW,EAAE;IAC7B,IAAA,uBAAe,GAAE,CAAC;IAClB,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACnC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAU,EAAE;IAC5C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE;IACvC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,OAAe,EAAU,EAAE;IAC7D,MAAM,IAAI,GAAG,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,IAAI,CAAC,aAAK,CAAC,SAAS,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,KAAa,EAAQ,EAAE;IAC7E,EAAE,CAAC,SAAS,CAAC,aAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,OAAe,EAAiB,EAAE;IACvE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,OAAe,EAAW,EAAE;IACnE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,kBAAkB;AAClB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,KAAa,EAAW,EAAE;IAC1E,MAAM,CAAC,GAAG,IAAA,yBAAS,EACjB,UAAU,EACV;QACE,sBAAsB;QACtB,IAAI;QACJ,IAAI;QACJ,GAAG,cAAc,IAAI,OAAO,EAAE;QAC9B,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,KAAK;KACN,EACD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;IACF,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC,CAAC;AACF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,OAAe,EAAiB,EAAE;IACjE,MAAM,CAAC,GAAG,IAAA,yBAAS,EACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,GAAG,cAAc,IAAI,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EACpF,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;IACF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACjC,CAAC,CAAC;AACF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,OAAe,EAAW,EAAE;IAC3D,MAAM,CAAC,GAAG,IAAA,yBAAS,EAAC,UAAU,EAAE;QAC9B,yBAAyB;QACzB,IAAI;QACJ,GAAG,cAAc,IAAI,OAAO,EAAE;QAC9B,IAAI;QACJ,OAAO;KACR,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF,gCAAgC;AAChC,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,KAAa,EAAW,EAAE;IAC5E,MAAM,CAAC,GAAG,IAAA,yBAAS,EACjB,aAAa,EACb;QACE,OAAO;QACP,SAAS;QACT,UAAU,OAAO,EAAE;QACnB,SAAS;QACT,GAAG,cAAc,IAAI,OAAO,EAAE;QAC9B,SAAS;QACT,OAAO;KACR,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CACnC,CAAC;IACF,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,OAAe,EAAiB,EAAE;IACnE,MAAM,CAAC,GAAG,IAAA,yBAAS,EACjB,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,cAAc,IAAI,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EACzE,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;IACF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACjC,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,OAAe,EAAW,EAAE;IAC7D,MAAM,CAAC,GAAG,IAAA,yBAAS,EAAC,aAAa,EAAE;QACjC,OAAO;QACP,SAAS;QACT,GAAG,cAAc,IAAI,OAAO,EAAE;QAC9B,SAAS;QACT,OAAO;KACR,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,GAAW,EAAW,EAAE;IAC1C,MAAM,CAAC,GAAG,IAAA,yBAAS,EAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;QACnF,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,GAAyC,EAAE;IAC3D,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAA,oCAA0B,GAAE;QAAE,OAAO,SAAS,CAAC;IACnF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEK,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,KAAa,EAAQ,EAAE;IACjF,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,IAAI,KAAK,KAAK;QAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;SACpD,IAAI,IAAI,KAAK,OAAO;QAAE,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;SAC7D,IAAI,IAAI,KAAK,SAAS;QAAE,EAAE,GAAG,IAAA,gBAAM,EAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClE,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,YAAG,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;AACH,CAAC,CAAC;AAZW,QAAA,SAAS,aAYpB;AAEK,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,OAAe,EAAiB,EAAE;IAC3E,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;SAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAA,gBAAM,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC,CAAC;AAbW,QAAA,SAAS,aAapB;AAEK,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,OAAe,EAAW,EAAE;IACxE,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,IAAI,KAAK,KAAK;QAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SAC7C,IAAI,IAAI,KAAK,OAAO;QAAE,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACtD,IAAI,IAAI,KAAK,SAAS;QAAE,EAAE,GAAG,IAAA,mBAAS,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,EAAE,IAAI,UAAU,CAAC;AAC1B,CAAC,CAAC;AARW,QAAA,YAAY,gBAQvB;AAEK,MAAM,cAAc,GAAG,GAAsC,EAAE,CAAC,CAAC;IACtE,OAAO,EAAE,SAAS,EAAE;IACpB,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC;AAHU,QAAA,cAAc,kBAGxB"}

package/dist/keychain/windows.d.ts

@@ -0,0 +1,5 @@
+export declare const isWindowsKeychainAvailable: () => boolean;
+export declare const winSet: (service: string, account: string, value: string) => boolean;
+export declare const winGet: (service: string, account: string) => string | null;
+export declare const winDelete: (service: string, account: string) => boolean;
+//# sourceMappingURL=windows.d.ts.map

package/dist/keychain/windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows.d.ts","sourceRoot":"","sources":["../../src/keychain/windows.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,0BAA0B,QAAO,OAI7C,CAAC;AAEF,eAAO,MAAM,MAAM,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,EAAE,OAAO,MAAM,KAAG,OAaxE,CAAC;AAEF,eAAO,MAAM,MAAM,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,KAAG,MAAM,GAAG,IAelE,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,KAAG,OAY5D,CAAC"}

package/dist/keychain/windows.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.winDelete = exports.winGet = exports.winSet = exports.isWindowsKeychainAvailable = void 0;
+/**
+ * Windows Credential Manager integration via `cmdkey` + PowerShell. Only
+ * active when process.platform === 'win32'. Follows the same
+ * service/account key layout as the macOS/Linux paths.
+ */
+const child_process_1 = require("child_process");
+const PREFIX = 'ForgeCLI:';
+const isWindowsKeychainAvailable = () => {
+    if (process.platform !== 'win32')
+        return false;
+    const r = (0, child_process_1.spawnSync)('cmdkey', ['/list'], { encoding: 'utf8' });
+    return r.status === 0;
+};
+exports.isWindowsKeychainAvailable = isWindowsKeychainAvailable;
+const winSet = (service, account, value) => {
+    const target = `${PREFIX}${service}`;
+    // `cmdkey /add` requires /pass:<plaintext> which isn't ideal. Prefer
+    // PowerShell + Windows.Security.Credentials when available.
+    const ps = `
+    $null = [Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
+    $vault = New-Object Windows.Security.Credentials.PasswordVault
+    try { $existing = $vault.Retrieve('${target}', '${account}'); $vault.Remove($existing) } catch {}
+    $cred = New-Object Windows.Security.Credentials.PasswordCredential('${target}', '${account}', '${value.replace(/'/g, "''")}')
+    $vault.Add($cred)
+  `;
+    const r = (0, child_process_1.spawnSync)('powershell', ['-NoProfile', '-Command', ps], { encoding: 'utf8' });
+    return r.status === 0;
+};
+exports.winSet = winSet;
+const winGet = (service, account) => {
+    const target = `${PREFIX}${service}`;
+    const ps = `
+    $null = [Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
+    $vault = New-Object Windows.Security.Credentials.PasswordVault
+    try {
+      $cred = $vault.Retrieve('${target}', '${account}')
+      $cred.RetrievePassword()
+      Write-Output $cred.Password
+    } catch { exit 1 }
+  `;
+    const r = (0, child_process_1.spawnSync)('powershell', ['-NoProfile', '-Command', ps], { encoding: 'utf8' });
+    if (r.status !== 0)
+        return null;
+    const value = r.stdout.trim();
+    return value || null;
+};
+exports.winGet = winGet;
+const winDelete = (service, account) => {
+    const target = `${PREFIX}${service}`;
+    const ps = `
+    $null = [Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
+    $vault = New-Object Windows.Security.Credentials.PasswordVault
+    try {
+      $cred = $vault.Retrieve('${target}', '${account}')
+      $vault.Remove($cred)
+    } catch { exit 1 }
+  `;
+    const r = (0, child_process_1.spawnSync)('powershell', ['-NoProfile', '-Command', ps], { encoding: 'utf8' });
+    return r.status === 0;
+};
+exports.winDelete = winDelete;
+//# sourceMappingURL=windows.js.map

package/dist/keychain/windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows.js","sourceRoot":"","sources":["../../src/keychain/windows.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,iDAA0C;AAE1C,MAAM,MAAM,GAAG,WAAW,CAAC;AAEpB,MAAM,0BAA0B,GAAG,GAAY,EAAE;IACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,CAAC,GAAG,IAAA,yBAAS,EAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC,CAAC;AAJW,QAAA,0BAA0B,8BAIrC;AAEK,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,KAAa,EAAW,EAAE;IACjF,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;IACrC,qEAAqE;IACrE,4DAA4D;IAC5D,MAAM,EAAE,GAAG;;;yCAG4B,MAAM,OAAO,OAAO;0EACa,MAAM,OAAO,OAAO,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;;GAE3H,CAAC;IACF,MAAM,CAAC,GAAG,IAAA,yBAAS,EAAC,YAAY,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC,CAAC;AAbW,QAAA,MAAM,UAajB;AAEK,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,OAAe,EAAiB,EAAE;IACxE,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG;;;;iCAIoB,MAAM,OAAO,OAAO;;;;GAIlD,CAAC;IACF,MAAM,CAAC,GAAG,IAAA,yBAAS,EAAC,YAAY,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC,CAAC;AAfW,QAAA,MAAM,UAejB;AAEK,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,OAAe,EAAW,EAAE;IACrE,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG;;;;iCAIoB,MAAM,OAAO,OAAO;;;GAGlD,CAAC;IACF,MAAM,CAAC,GAAG,IAAA,yBAAS,EAAC,YAAY,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC,CAAC;AAZW,QAAA,SAAS,aAYpB"}

package/dist/logging/logger.d.ts

@@ -0,0 +1,12 @@
+export type LogLevel = 'debug' | 'info' | 'warn' | 'error';
+export declare const setLevel: (level: LogLevel) => void;
+export declare const setConsoleOutput: (enabled: boolean) => void;
+export declare const getLevel: () => LogLevel;
+export declare const log: {
+    debug: (msg: string, meta?: Record<string, unknown>) => void;
+    info: (msg: string, meta?: Record<string, unknown>) => void;
+    warn: (msg: string, meta?: Record<string, unknown>) => void;
+    error: (msg: string, meta?: Record<string, unknown>) => void;
+};
+export declare const closeLogs: () => void;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logging/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/logging/logger.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAa3D,eAAO,MAAM,QAAQ,GAAI,OAAO,QAAQ,KAAG,IAE1C,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,KAAG,IAEnD,CAAC;AAEF,eAAO,MAAM,QAAQ,QAAO,QAAwB,CAAC;AAuDrD,eAAO,MAAM,GAAG;iBACD,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBACvC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBACtC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;iBACrC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CACpD,CAAC;AAEF,eAAO,MAAM,SAAS,QAAO,IAK5B,CAAC"}

package/dist/logging/logger.js

@@ -0,0 +1,127 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.closeLogs = exports.log = exports.getLevel = exports.setConsoleOutput = exports.setLevel = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const paths_1 = require("../config/paths");
+const redact_1 = require("../security/redact");
+const LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 };
+let currentLevel = process.env.FORGE_LOG_LEVEL || 'info';
+/** When false, warn/error/info are NOT written to stderr/stdout — only to
+ *  the rotating file under ~/.forge/logs/forge.log. Used by the interactive
+ *  REPL so provider errors don't corrupt the rendered TUI frame. File
+ *  logging is unaffected, so the same info is still discoverable after the
+ *  session. */
+let consoleEnabled = !process.env.FORGE_LOG_QUIET;
+const setLevel = (level) => {
+    currentLevel = level;
+};
+exports.setLevel = setLevel;
+const setConsoleOutput = (enabled) => {
+    consoleEnabled = enabled;
+};
+exports.setConsoleOutput = setConsoleOutput;
+const getLevel = () => currentLevel;
+exports.getLevel = getLevel;
+const shouldLog = (level) => LEVEL_RANK[level] >= LEVEL_RANK[currentLevel];
+const logFile = () => {
+    try {
+        fs.mkdirSync(paths_1.paths.logs, { recursive: true });
+    }
+    catch {
+        // ignore — best effort
+    }
+    return path.join(paths_1.paths.logs, 'forge.log');
+};
+let fileStream = null;
+const getStream = () => {
+    if (fileStream)
+        return fileStream;
+    try {
+        // Lazy rotation check on first write (cheap). Daemon also runs it.
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const { rotateIfNeeded } = require('./rotation');
+            rotateIfNeeded();
+        }
+        catch {
+            /* ignore */
+        }
+        fileStream = fs.createWriteStream(logFile(), { flags: 'a' });
+        return fileStream;
+    }
+    catch {
+        return null;
+    }
+};
+const format = (level, msg, meta) => {
+    const entry = {
+        ts: new Date().toISOString(),
+        level,
+        msg,
+        ...(meta ? { meta: (0, redact_1.redact)(meta) } : {}),
+    };
+    return JSON.stringify(entry);
+};
+const write = (level, msg, meta) => {
+    if (!shouldLog(level))
+        return;
+    const line = format(level, msg, meta);
+    const stream = getStream();
+    stream?.write(line + '\n');
+    if (!consoleEnabled)
+        return;
+    if (level === 'error' || level === 'warn') {
+        process.stderr.write(line + '\n');
+    }
+    else if (process.env.FORGE_LOG_STDOUT) {
+        process.stdout.write(line + '\n');
+    }
+};
+exports.log = {
+    debug: (msg, meta) => write('debug', msg, meta),
+    info: (msg, meta) => write('info', msg, meta),
+    warn: (msg, meta) => write('warn', msg, meta),
+    error: (msg, meta) => write('error', msg, meta),
+};
+const closeLogs = () => {
+    if (fileStream) {
+        fileStream.end();
+        fileStream = null;
+    }
+};
+exports.closeLogs = closeLogs;
+//# sourceMappingURL=logger.js.map